linux/net, branch v2.6.30.8

cfg80211: fix looping soft lockup in find_ie()

2009-09-24T15:27:10Z

commit fcc6cb0c13555e78c2d47257b6d1b5e59b0c419a upstream. The find_ie() function uses a size_t for the len parameter, and directly uses len as a loop variable. If any received packets are malformed, it is possible for the decrease of len to overflow, and since the result is unsigned, the loop will not terminate. Change it to a signed int so the loop conditional works for negative values. This fixes the following soft lockup: [38573.102007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230] [38573.102007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan] [38573.102007] irq event stamp: 2547724535 [38573.102007] hardirqs last enabled at (2547724534): [] restore_all_notrace+0x0/0x18 [38573.102007] hardirqs last disabled at (2547724535): [] apic_timer_interrupt+0x28/0x34 [38573.102007] softirqs last enabled at (92950144): [] __do_softirq+0x108/0x210 [38573.102007] softirqs last disabled at (92950274): [] _spin_lock_bh+0x14/0x80 [38573.102007] [38573.102007] Pid: 2230, comm: phy0 Tainted: G W (2.6.31-rc7-wl #8) MacBook1,1 [38573.102007] EIP: 0060:[] EFLAGS: 00010292 CPU: 0 [38573.102007] EIP is at cmp_ies+0x30/0x180 [cfg80211] [38573.102007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014 [38573.102007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c [38573.102007] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [38573.102007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0 [38573.102007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [38573.102007] DR6: ffff0ff0 DR7: 00000400 [38573.102007] Call Trace: [38573.102007] [] cmp_bss+0xed/0x100 [cfg80211] [38573.102007] [] cfg80211_bss_update+0x84/0x410 [cfg80211] [38573.102007] [] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211] [38573.102007] [] ieee80211_bss_info_update+0x4f/0x180 [mac80211] [38573.102007] [] ieee80211_rx_bss_info+0x88/0xf0 [mac80211] [38573.102007] [] ? ieee802_11_parse_elems+0x27/0x30 [mac80211] [38573.102007] [] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211] [38573.102007] [] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211] [38573.102007] [] ? sched_clock+0x27/0xa0 [38573.102007] [] ? sched_clock+0x27/0xa0 [38573.102007] [] ? mark_held_locks+0x60/0x80 [38573.102007] [] ? _spin_unlock_irqrestore+0x55/0x70 [38573.102007] [] ? sub_preempt_count+0x85/0xc0 [38573.102007] [] ? _spin_unlock_irqrestore+0x3e/0x70 [38573.102007] [] ? skb_dequeue+0x4f/0x70 [38573.102007] [] ieee80211_sta_work+0x91/0xb80 [mac80211] [38573.102007] [] ? sched_clock+0x27/0xa0 [38573.102007] [] ? sub_preempt_count+0x85/0xc0 [38573.102007] [] worker_thread+0x18f/0x320 [38573.102007] [] ? worker_thread+0x12e/0x320 [38573.102007] [] ? _spin_unlock_irqrestore+0x55/0x70 [38573.102007] [] ? ieee80211_sta_work+0x0/0xb80 [mac80211] [38573.102007] [] ? autoremove_wake_function+0x0/0x50 [38573.102007] [] ? worker_thread+0x0/0x320 [38573.102007] [] kthread+0x84/0x90 [38573.102007] [] ? kthread+0x0/0x90 [38573.102007] [] kernel_thread_helper+0x7/0x10 Signed-off-by: Bob Copeland Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman

net: net_assign_generic() fix

2009-09-15T17:45:16Z

[ Upstream commit 144586301f6af5ae5943a002f030d8c626fa4fdd ] memcpy() should take into account size of pointers, not only number of pointers to copy. Signed-off-by: Eric Dumazet Acked-by: Pavel Emelyanov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

gre: Fix MTU calculation for bound GRE tunnels

2009-09-15T17:45:12Z

[ Upstream commit 8cdb045632e5ee22854538619ac6f150eb0a4894 ] The GRE header length should be subtracted when the tunnel MTU is calculated. This just corrects for the associativity change introduced by commit 42aa916265d740d66ac1f17290366e9494c884c2 ("gre: Move MTU setting out of ipgre_tunnel_bind_dev"). Signed-off-by: Tom Goff Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

dccp: missing destroy of percpu counter variable while unload module

2009-09-15T17:45:05Z

[ Upstream commit 476181cb05c6a3aea3ef42309388e255c934a06f ] percpu counter dccp_orphan_count is init in dccp_init() by percpu_counter_init() while dccp module is loaded, but the destroy of it is missing while dccp module is unloaded. We can get the kernel WARNING about this. Reproduct by the following commands: $ modprobe dccp $ rmmod dccp $ modprobe dccp WARNING: at lib/list_debug.c:26 __list_add+0x27/0x5c() Hardware name: VMware Virtual Platform list_add corruption. next->prev should be prev (c080c0c4), but was (null). (next =ca7188cc). Modules linked in: dccp(+) nfsd lockd nfs_acl auth_rpcgss exportfs sunrpc Pid: 1956, comm: modprobe Not tainted 2.6.31-rc5 #55 Call Trace: [] warn_slowpath_common+0x6a/0x81 [] ? __list_add+0x27/0x5c [] warn_slowpath_fmt+0x29/0x2c [] __list_add+0x27/0x5c [] __percpu_counter_init+0x4d/0x5d [] dccp_init+0x19/0x2ed [dccp] [] do_one_initcall+0x4f/0x111 [] ? dccp_init+0x0/0x2ed [dccp] [] ? notifier_call_chain+0x26/0x48 [] ? __blocking_notifier_call_chain+0x45/0x51 [] sys_init_module+0xac/0x1bd [] sysenter_do_call+0x12/0x22 Signed-off-by: Wei Yongjun Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

NET: llc, zero sockaddr_llc struct

2009-09-09T03:34:11Z

commit 28e9fc592cb8c7a43e4d3147b38be6032a0e81bc upstream. sllc_arphrd member of sockaddr_llc might not be changed. Zero sllc before copying to the above layer's structure. Signed-off-by: Jiri Slaby Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

rose: Fix rose_getname() leak

2009-09-09T03:34:10Z

commit 17ac2e9c58b69a1e25460a568eae1b0dc0188c25 upstream. rose_getname() can leak kernel memory to user. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

econet: Fix econet_getname() leak

2009-09-09T03:34:10Z

commit 80922bbb12a105f858a8f0abb879cb4302d0ecaa upstream. econet_getname() can leak kernel memory to user. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

netrom: Fix nr_getname() leak

2009-09-09T03:34:09Z

commit f6b97b29513950bfbf621a83d85b6f86b39ec8db upstream. nr_getname() can leak kernel memory to user. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

appletalk: fix atalk_getname() leak

2009-09-09T03:34:08Z

commit 3d392475c873c10c10d6d96b94d092a34ebd4791 upstream. atalk_getname() can leak 8 bytes of kernel memory to user Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

irda: Fix irda_getname() leak

2009-09-09T03:34:07Z

commit 09384dfc76e526c3993c09c42e016372dc9dd22c upstream. irda_getname() can leak kernel memory to user. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman